CTRL/SHIFT - 14 06 2026 PARTHENOPE STAGE - STEFANO DE ANGELIS - PRIVACY ON ETHEREUM

Okay. So, in the meantime, uh hello everyone. I'm Stephano. I'm a researcher at Nethermind. Um for those who don't know Nethermind, it's um blockchain company focused on research and development in the space.

Um Nethermind is also one of the major uh Ethereum clients. So for those who don't know what an Ethereum client is, is like a piece of software that implements the Ethereum protocol uh and gives access to the execution layer of of Ethereum virtual machine. Um, of course, Netherm is a is big company and we're building different branches on different areas of research and development. One is institutional uh others are more deep around research. Um my role is around doing research on distributed systems, consensus protocols and privacy recently.

So there is a new line of work uh around uh privacy on on Ethereum. But in general I want here the audience to focus on privacy around public ledgers. So okay so I I divided the talk in in three in three parts. Uh we will go through through them uh in a minute. So we start with uh why privacy matters uh on public ledgers uh today and what do we have in terms of tools to to achieve privacy and this big uh um problem around privacy and compliance uh how we can we can we can bridge this gap.

Okay. So let's start uh let's set the ground like this was like a a a scientific papers. So in the model the system model we have it's a a public blockchain. So a public ledger uh and we all know that public ledgers are transparent and immutable distributed ledgers of transactions. So transparent means that you have access to the data and the transactions that that are happening there and immutable that is you you cannot apart from some uh specific attack scenarios you cannot uh change the story of the ledger and yeah so let's uh set the ground for a very basic simple example you might have heard uh you are running on a public ledger you have your wallet and you want to pay coffee in USDC so when you go to uh a shop, you buy your coffee and what happens there is that the merchant that is receiving the payment is actually able to uh inspect the payment and this is because of transparency property of ledgers.

So the amount and the counterparties are both visible just by um checking on a blockchain explorer. So the full history and your balance could be also visible to the merchant and this is something that you can you can do right. So you can look on a on a blockchain explorer and there is an address and you can look at the balance of the explorer and the history of transactions. So everything is public and visible there and this is actually uh around like people are building business models around this property. So there are companies like Harkham that are doing some uh analytics on public ledgers and they actually successfully the anonymized wallets in the recent history.

So for example here they were able to deonymize the Robin Hood wallet which is a you know a trading company in the US as the one of the largest Ethereum whales in the space. So this is one area of privacy is a concern but at the same time uh public rails adoption is growing. Uh when I say it's growing it means that uh public institutions are actually looking at uh public ledgers and we can see it as the grow of the adoption uh in terms of stable coins but also real world tokenized assets financial assets like treasury depth uh commodities and other type of assets. So people are actually looking uh at blockchains. So the the thing is that for the last decade uh institutions were looking at private permission at chains so closed environments so that they can control because they were familiar with that.

Uh but now we we have we are noticing this drift to toward public ledgers like like Ethereum. So we can say that privacy uh is is the is the main challenge there. uh public rails are winning the the the the uh the blockchain era but privacy is now the blocker. So this is a mood u because to unlock global finance to to reach public ledgers we do need privacy because for traditional financial assets we don't know we don't want to leak uh you know money flows treasuries uh whatever strategies an institutional fund may have or counterparties. Okay.

So we we reached the first part. So on the second part I want to discuss uh what do we have today for for providing privacy on public ledgers. Um there are many use cases but I would like to the audience to to focus on three major areas. So we we want when we are on public ledger we want private transfers right? So we want when we do a payment we do a transfer we don't want to leak uh things like the amounts the senders and the counterparties.

Um, another interesting area is private state computation. Uh, you can see it like if you have private states like I don't know uh an order book and everything is encrypted there and you want to do some computation over the order book to for example the uh matching the orders. Uh you can do it in a confidential privacy preserving way uh with the with privacy computation and then confidential data sharing is just uh self-explanatory. So uh just a little bit of uh context on the toolbox we have we have many primitives and it's not just about encryption but we do have some cryptographic techniques that we can adopt and cryptographic primitives primitives that we can adopt to um to achieve privacy. I will mention a few of them that covers the use cases I was mentioning.

So we have TK zero knowledge proofs that allows you to prove statements in a privacy preserving manner. Uh we have FHE fully encryption where you can actually uh perform computation over encrypted data. Uh there are many trade-offs here. So we'll just list them. Trusted execution environments where you encapsulate in a in a hardware uh the computation but of course you have to trust the hardware and then MPC where you can split the work across different parties in a private way.

Um all these parts uh come with a with a with with oops with trade-offs. So we will focus here on zero knowledge proofs because of the most practical approach and as a privacy model um we are looking into application level privacy where you implement the privacy solution on top of the application level in a smart contract for example. There are many different approaches. So you can build for example private L2s on Ethereum like atte uh where you can uh relegate the privacy computation on a layer 2 and then leverage Ethereum just for for settlement. So today we focus on application level privacy.

Um there are talks later on today that uh introduce shielded pools uh but I will briefly talk about them. So a shielded pool is an application level solution uh to provide the privacy layer to any asset that is living on a public ledger and the idea is that you have a smart contract that implements a sort of shield level for your assets. So the way it works is that user will escrow their own funds uh into this smart contract which retains um um a confidential uh registry of ownership of these assets and users will leverage then uh zero knowledge proofs to unlock the ownership and transfer payments um everything under privacy uh under privacy preserving constraints. So this is not something new. Uh Zcash uh pioneered this solution and then we have solution on Ethereum that are leveraging smart contracts like tornado cache, rail gun and privacy pools.

We will have talks later about these folks. Uh the properties we get uh we we we have anonymity in the sense that we break uh we we don't know in a transfer the sender and the receiver everything is completely anonymous. Uh privacy pool uh provide unlinkability. So you cannot link um transfers and deposit and withdrawals from this the source and the destination and then you have this thing of hiding balances. So people external observers cannot see the balances of of people.

So the problem is that okay anonymity we can we can we can we can do that today on Ethereum on public ledgers but this is not very good for financial markets and we will see in a minute why. So um yeah so this goes to the second the third part and final part of this talk um where we want to discuss privacy and and compliance together. Um why this is important. So this is the tornado cache use case. Tornado cache is a protocol that implemented a sort of shieldpool uh technology is a mixer and in August 2022 US authorities um banned and sanctioned tornado cashache because of uh 7 billions of illicit transactions uh because you know everything was anonymous everything was private so US authorities were just saying okay you're using for it for for money laundering this kind of stuff so the the founder Roman storm was actually in icted for money laundering in 2023.

There have been some back back and forth with US authority. Uh long story short, uh they decided that you know open source protocol and smart contract protocol cannot be sanctioned directly but still there are some problems and some ongoing uh conviction convicted things uh with Roman storm uh and this is because the they accused him to not implement him and the developers to not implemented safeguards at the shieldpool level. What are safeguards? So compliance safeguards is something that we are very familiar with in in traditional finance. So when you you trade your assets like whatever treasury bond you actually the bank is retaining some compliance safeguards.

The most well-known is access control, right? So when you when you go to your bank, you want to uh control uh the bank wants to you to be KYC want they want to know who you are and if you can access to this financial assets and this is something that most of the protocol that provide privacy on public ledgers are doing today. But this is not enough right because in the in the real world you need something also called pool visibility. So imagine you have a a shield pool. You want to actually selectively see what's going on in the pool for a specific user if the regulator is interested in.

And this is something we know as selective disclosure. Finally and more importantly asset controls. So in cryptank world we want self-control but in the real world in financial assets actually regulators want to retain some control because if there is some um legal problem they want to you know freeze an account claw back the assets and this is something that we cannot escape also on privacy level uh privacy solution on public ledgers if we want to bring uh institutional adoption. So we'll go fast here. Uh the long story short is that we can implement this thing in zero knowledge proofs.

So recall we are focusing on shielded pools in this talk. So if we have zero knowledge proofs and shielded pools we actually can implement um access control and this is something that uh um privacy pools are doing and other folks are doing with association sets and other kind of KYC solution. The idea is that when there is a deposit, there is a compliance control module that checks that the users come from uh legit sources. We can do selective disclosure. This can be easily achieved by cryptography by sharing view something called viewing keys, cryptographic keys that give access to certain transactions to for example to to a regulator.

Uh this is on withdrawals but also on private transfers inside the pool the regulator can inspect. And finally, uh this is the probably the most difficult part. People are not really actively looking at at it from the best of my knowledge, but it's still very relevant. Implementing asset controls like freezing an asset, clawing back functionalities within the pool in zero knowledge is quite difficult, but it's possible to do it and that's what we are doing at Nethermind. Um just to to conclude I want to show you this graph in which you we have privacy and compliance.

Um let's say we have maximum privacy with tornado cache but we don't have compliance right and then we have on the other way of spectrum full transparency on Ethereum but we don't have privacy. So with shield pools we go on this spectrum where every time we implement a compliance hook we actually lose a bit of of privacy. For example, if we have KYC on your pool, you actually reduce the access to the pool only to KYC users. So the something called anonymity set is reduced. So the more compliance hooks you you add on your shield pool, the lower privacy uh you will get to until to a a certain threshold and equilibria.

Uh private rails uh they are somehow in the middle. Of course this is not formal graph uh but they are on another spectrum. So take away from this talk is that uh public ledgers are winning uh the race and they need privacy and actually privacy is is achievable and practical. We we know that from uh existing protocols on chain. The hard part is compliance and the the ecosystem is working on it with the you know adding this and that hooks uh of compliance and what it matters really is that we have to ship a a solution that provide full compliance rule to bring institutional finance on chain with the right trade-offs.

So we can do it even configurable like with a a sort of policy on which type of compliance you need on your pool level. Thank you very much.